Static task
static1
General
-
Target
3cf2775b3ea7ca3ae2964a3e98d1b9e0
-
Size
21KB
-
MD5
3cf2775b3ea7ca3ae2964a3e98d1b9e0
-
SHA1
f150c1e3944a1bd6cd4dbffb80ca34b3d571a39e
-
SHA256
7918ec68f9763961ad91e58d9957a2f9a1553a1bb3324432cb1b18db1ea9c899
-
SHA512
51d9481b0f8b7bea69a226ce6f8cab2a313aa5402eaca7f5d3f15ae79a586dbc8d041ccbd02674e9e5ab49c920624040a70165e4e507dd52ee003e2020ca71d1
-
SSDEEP
384:4gmLbpmAU2a+zja3U5ND71vc0HvRhvXk4sIKsEnnz:fIU2a+K3U171c0Hphfk9PsI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cf2775b3ea7ca3ae2964a3e98d1b9e0
Files
-
3cf2775b3ea7ca3ae2964a3e98d1b9e0.sys windows:5 windows x86 arch:x86
9e5769185b680cb955e4a6c630e1bc1d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
IofCompleteRequest
RtlInitUnicodeString
ZwDeleteFile
ZwCreateFile
ZwWriteFile
ZwClose
strstr
DbgPrint
RtlAssert
hal
KeGetCurrentIrql
ndis.sys
NdisPacketPoolUsage
NdisReEnumerateProtocolBindings
NdisIMNotifyPnPEvent
NdisQueryPendingIOCount
NdisDprAllocatePacket
NdisDprFreePacket
NdisIMCancelInitializeDeviceInstance
NdisIMDeInitializeDeviceInstance
NdisGetReceivedPacket
NdisResetEvent
NdisSetEvent
NdisReleaseSpinLock
NdisAcquireSpinLock
NdisMSetAttributesEx
NdisIMGetDeviceContext
NdisFreePacket
NdisIMCopySendCompletePerPacketInfo
NdisIMCopySendPerPacketInfo
NdisAllocatePacket
NdisSend
NdisIMGetCurrentPacketStack
NdisFreeMemory
NdisQueryBufferSafe
NdisAllocateMemory
NDIS_BUFFER_TO_SPAN_PAGES
NdisQueryBufferOffset
NdisRequest
NdisReturnPackets
NdisGetPoolFromPacket
NdisTransferData
NdisWaitEvent
NdisCloseAdapter
NdisCancelSendPackets
NdisFreePacketPool
NdisTerminateWrapper
NdisIMAssociateMiniport
NdisIMDeregisterLayeredMiniport
NdisRegisterProtocol
NdisInitUnicodeString
NdisMRegisterUnloadHandler
NdisIMRegisterLayeredMiniport
NdisInitializeWrapper
NdisAllocateSpinLock
NdisMRegisterDevice
NdisMSleep
NdisMDeregisterDevice
NdisDeregisterProtocol
NdisCloseConfiguration
NdisIMInitializeDeviceInstanceEx
NdisOpenAdapter
NdisAllocatePacketPoolEx
NdisInitializeEvent
NdisAllocateMemoryWithTag
NdisReadConfiguration
NdisOpenProtocolConfiguration
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 374B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 980B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ